diff --git a/services/ha-diag-agent/DEPLOY.md b/services/ha-diag-agent/DEPLOY.md
index 0e382d4..680a9e6 100644
--- a/services/ha-diag-agent/DEPLOY.md
+++ b/services/ha-diag-agent/DEPLOY.md
@@ -115,8 +115,8 @@ docker ps | grep ha-diag-agent
 # Last 50 log lines
 docker logs ha-diag-agent --tail 50
 
-# FastAPI health endpoint
-curl http://localhost:8087/health
+# FastAPI health endpoint (no host port mapping — probe via docker exec)
+docker exec ha-diag-agent python -c "import urllib.request; print(urllib.request.urlopen('http://localhost:8087/health', timeout=5).read().decode())"
 # Expect: {"status": "ok", "ws_connected": true, ...}
 
 # Events are being written
diff --git a/services/ha-diag-agent/README.md b/services/ha-diag-agent/README.md
index c35e499..9c61877 100644
--- a/services/ha-diag-agent/README.md
+++ b/services/ha-diag-agent/README.md
@@ -23,7 +23,7 @@ WebSocketMonitor (persistent, long-running — Phase 4b)
      silence > 5min or on disconnect. Emits ha_websocket_recovered
      when the connection is restored after a dead alert.
 
-FastAPI (port 8087)
+FastAPI (port 8087, internal only — no host port mapping)
   GET  /health             → liveness probe (includes ws_connected field)
   POST /trigger/<check>    → run a named check on demand
 
@@ -97,7 +97,7 @@ scripts/deploy/deploy.sh --service ha-diag-agent
 
 # 3. Verify
 docker ps --filter name=ha-diag-agent
-curl http://localhost:8087/health
+docker exec ha-diag-agent python -c "import urllib.request; print(urllib.request.urlopen('http://localhost:8087/health', timeout=5).read().decode())"
 ```
 
 ### chelsty-infra note